Last reviewed: 14 August 2026
Conversio is an Operator, as defined in section 1 of the Protection of Personal Information Act, 2013, processing personal information on behalf of the organisations that use it. This register names every third party that receives personal information through the Service, what each one receives, where it processes that information, and the section 72 ground we rely on to transfer it outside the Republic.
The register is generated from the integrations the product actually calls. It is reviewed whenever a vendor is added or removed.
Ireland is a member state of the European Union and is subject to the General Data Protection Regulation, which we rely on as a law providing an adequate level of protection under section 72(1)(a). POPIA does not require that personal information be stored inside South Africa; it requires that any transfer out of it rests on one of the section 72 grounds. Each one is named below.
| Subprocessor | Purpose | Personal information received | Location | Transfer ground |
|---|---|---|---|---|
| Supabase | Primary database, authentication, file storage and serverless functions | All contact records, message and call history, consent evidence, lead data and uploaded documents | Ireland (European Union) (eu-west-1) | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Meta Platforms (WhatsApp Business API) | Delivery and receipt of WhatsApp messages | Contact phone numbers, message content, media attachments and delivery receipts | Outside South Africa | s72(1)(d): necessary for a contract concluded in the data subject’s interest |
| Anthropic | The conversational AI agent that drafts replies and qualifies leads | Message content, conversation history and contact context supplied as model input | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Voyage AI | Text embeddings for knowledge-base search | Knowledge-base content and search queries | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| OpenAI Engaged only when voice-note transcription is configured | Speech-to-text transcription of WhatsApp voice notes | Audio recordings of voice notes sent by contacts, and the resulting transcript | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Twilio Voice channel only | Telephony for inbound and outbound voice calls | Contact phone numbers, call metadata and call audio streams | Outside South Africa | s72(1)(d): necessary for a contract concluded in the data subject’s interest |
| Deepgram Voice channel only | Speech-to-text for the live voice agent | Call audio and transcripts | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Cartesia Voice channel only | Text-to-speech for the live voice agent (primary) | Text the agent speaks, which may contain contact details | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| ElevenLabs Voice channel only, and only during a primary-provider outage | Text-to-speech failover when the primary provider is unavailable | Text the agent speaks, which may contain contact details | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Resend Email channel only | Delivery of transactional and outbound email | Contact email addresses, names and email content | Outside South Africa | s72(1)(d): necessary for a contract concluded in the data subject’s interest |
| Google (Calendar API) Only where an organisation connects a Google Calendar | Reading availability and writing appointments to a connected staff calendar | Appointment times, attendee names, contact details and meeting notes | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Upstash | Redis cache, distributed locks and background job queueing | Short-lived conversation state and job payloads which may reference contact identifiers | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Railway | Hosting for the marketing site, dashboard and the voice orchestrator service | Call audio in transit, and application request logs | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Sentry | Application error monitoring | Error reports and stack traces, which may incidentally contain contact identifiers | Outside South Africa | s72(1)(a): recipient bound by a law or agreement providing substantially similar protection |
| Paystack | Processing ZAR subscription payments | Billing contact and payment details of the subscribing organisation. Receives no contact data | Outside South Africa | s72(1)(c): necessary to perform a contract with the data subject |
Where the transfer ground is section 72(1)(a), it rests on a data processing agreement with that vendor. A copy of any agreement in this register is available to a customer on request from our Information Officer.
We will update this page before engaging a new subprocessor that receives personal information. Customers on an Operator Agreement are notified of additions in advance and may object on reasonable grounds.
Contact our Information Officer at privacy@ambitx.ai. See also our Privacy Policy and POPIA Compliance pages.